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Amendments to the CiaFms: 

This listing of claims replaces all prior verelons. and listings, of claims in the application: 

Listing of Claims: 
1-12. (Cancelled) 

13. (Previously Presented) A method for preventing lllegitmate use of an 

Intemet Protocol (IP) address by a subscriber device In an IP network, the network 
Including a switch node and at least one DHCP sender, said subscriber device in 
communication with the switch node, the method including the steps of: 

creating a list of tmsted ones of the DHCP servers in said switch node; 

transmitting by the subscriber device a DHCP request message for an IP address; 

receiving a reply message by said switch node which cames an assigned subscriber 
IP address; 

analysing the reply message by said switch node to be a DHCP message and 
having a source address from one of the tnjsted DHCP sewers; 

updating a filter dynamically in the switch node, the filter 6te>ring an identification of 
the subscriber device and the assigned subscriber IP address; 

transmitting a frame from the subscriber devk». using a source IP address;. 

comparing in the filter said source IP address with the stored subscriber IP address; 

and, 

discarding said frame when said source IP address differs from the stored subscriber 
IP. address. 



14. (Previously Presented) The method according to claim 13, further 

comprising the step of storing in the filter a subscriber MAC address, a subscriber 
physical port number, a subscriber virtual LAN identity and a lease time inteniral for the 
assigned subscriber IP address. 
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1 5. (Previously Presented) The method according to claim 13, wherein the 
subscriber IP address is statically assigned and handled by the DHCP servers. 

1 6. (Previously Presented) The method according to claim 14, the method 
including deleting the subscriber identification and the corresponding assigned 
subscriber IP address from the filter when the lease time interval Is out. 

1 7. (Previously Presented) The method according to daim 13, the method 
further comprising the steps of: 

counting a number of atteiripts (n) from the subscriber to use an Illegitimate IP 
address; 

comparing the number (n) of the attempts with a threshold number (N); 

sending a warning signal when the number (rf attempts exceeds a threshold criteria. 

18. (Previously Presented) A switch node in an internet Protocol (IP) 
networi< adapted to prevent illegltmate use of an IP address by a subscriber device, the 
switch node including: 

at least one port fer communication with a subscriber device; 

an upilni< port for communication with DHCP servers in the networic; and, 

a filter device having a list of tmsted ones of the DHCP servers, the filter device 
being associated with the ports; wherein the switch node is operative to: 

receive a subscriber IP address request message from a subscriber device, analyse 
it to be a DHCP request message and transmit it on the uplink port; 

receive a reply message on the uplink port, analyse it to be a DHCP reply message 
having a source IP address from one of the trusted DHCP servers on the list; 

dynamically update the filter with an Identification of the subscriber device and a 
con-esponding assigned subscriber IP address contained In the DHCP reply message; 

receive a frame with a source IP address from a subscriber device; 

compare In the fiiter saW source IP address with the stored subscriber IP address for 
the subscriber device; and. 
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to discard said frame when said source IP address differs from the stored subscriber 
IP address. 

19. (Previously Presented) The switch node according to claim 18. 

wherein the switch node is further operative to store in the filter a subscriber IVIAC 
address, a subscriber physical port number, a subscriber virtual LAN identity and a 
lease time interval for the assigned subscriber IP address. 



20. (Previously Presented) The switch node according to claim 18. wherein 

the subscriber IP address comprises a statically assigned address which is handled by the 
DHCP servers. 



21. (Previously Presented) The switch node according to claim 19. wherein 
the switch node is further operative to delete the subscriber Identification and the 
oon^sponding assigned subscriber IP address from the filter when the lease time inten/al 
is (W t expires. 

22. (Previously Presented) The swflch node according to claim 18, wherein 
the filter comprises a counter operative to count a number (n) of discarded frames on the 
subscriber port, to compare the number (n) of the discarded frames with a threshold 
number (N). and to send a waming signal when the number of discarded frames exceeds 
a threshold criterion. 
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